Install the agent

One static binary for amd64 and arm64, packaged with a hardened systemd service. The packages and the install script put the same program, settings file and service in place, and the program is called gryphon-agent.

VERSION=1.1.28
BASE=https://github.com/gocodedotca/gryphon-agent/releases/download/v$VERSION
ARCH=$(dpkg --print-architecture)
curl -fLO $BASE/gryphon-agent_${VERSION}_$ARCH.deb
curl -fLO $BASE/SHA256SUMS
sha256sum --ignore-missing -c SHA256SUMS
sudo apt install ./gryphon-agent_${VERSION}_$ARCH.deb

VERSION=1.1.28
BASE=https://github.com/gocodedotca/gryphon-agent/releases/download/v$VERSION
ARCH=$(uname -m | sed 's/x86_64/amd64/; s/aarch64/arm64/')
curl -fLO $BASE/gryphon-agent_${VERSION}_$ARCH.rpm
curl -fLO $BASE/SHA256SUMS
sha256sum --ignore-missing -c SHA256SUMS
sudo dnf install ./gryphon-agent_${VERSION}_$ARCH.rpm

curl -fsSLO https://raw.githubusercontent.com/gocodedotca/gryphon-agent/main/deploy/agent/install.sh
less install.sh
sudo sh install.sh

VERSION=1.1.28
BASE=https://github.com/gocodedotca/gryphon-agent/releases/download/v$VERSION
ARCH=$(uname -m | sed 's/x86_64/amd64/; s/aarch64/arm64/')
curl -fLO $BASE/gryphon-agent_${VERSION}_linux_$ARCH.tar.gz
curl -fLO $BASE/SHA256SUMS
sha256sum --ignore-missing -c SHA256SUMS
tar -xzf gryphon-agent_${VERSION}_linux_$ARCH.tar.gz
read -rsp "Token: " TOKEN; echo
(umask 077; printf '%s\n' "$TOKEN" > agent_key); unset TOKEN
GWC_KEY_FILE=./agent_key ./gryphon-agent

sudo gryphon-agent enrol

systemctl status gryphon-agent
sudo journalctl -u gryphon-agent -n 50

Once the host's page in Gryphon says Connected, add the agent's checks under Manage Services: disk, memory, CPU and load, databases, Docker, scripts, files, and HTTP, ping and TCP from inside your network.

The same agent as a Windows service, for Windows 10 and 11 and Windows Server 2016 or later, on x64 or Arm. One command sets up the service and a settings folder only administrators can change, and another gives it its token.

Use one PowerShell window for both steps, opened as administrator: Start, type PowerShell, then choose Run as administrator.

$ProgressPreference = "SilentlyContinue"
Set-Location $env:TEMP
$Version = "1.1.28"
$Arch = "amd64"
if ("$env:PROCESSOR_ARCHITECTURE $env:PROCESSOR_ARCHITEW6432" -match "ARM64") { $Arch = "arm64" }
$Base = "https://github.com/gocodedotca/gryphon-agent/releases/download/v$Version"
$Zip = "gryphon-agent_${Version}_windows_$Arch.zip"
Invoke-WebRequest "$Base/$Zip" -OutFile $Zip
Invoke-WebRequest "$Base/SHA256SUMS" -OutFile SHA256SUMS
$Want = (Select-String -Path SHA256SUMS -SimpleMatch $Zip).Line.Split(" ")[0]
if ((Get-FileHash $Zip).Hash -ne $Want) { throw "checksum mismatch" }
Expand-Archive $Zip -DestinationPath gryphon-agent -Force

.\gryphon-agent\gryphon-agent.exe service install

& 'C:\Program Files\Gryphon Agent\gryphon-agent.exe' enrol

Get-Service GryphonAgent
Get-WinEvent -FilterHashtable @{LogName="Application"; ProviderName="GryphonAgent"} -MaxEvents 20

Once the host's page in Gryphon says Connected, add the agent's checks under Manage Services: disk, memory, CPU and load, databases, Docker, scripts, files, and HTTP, ping and TCP from inside your network.

Troubleshooting

Enrolling says “Gryphon refused this token”

The token was copied short, or it has been replaced since. Copy it again, whole, from the dialog in step 1; if that is closed, choose Replace token on the host's page and enrol with the new one.

Enrolling says “Cannot reach Gryphon”

The machine cannot make the connection out. Check the network: an outbound firewall, a proxy that needs HTTPS_PROXY, or no route to the internet at all.

The host's page says “Waiting for the agent to connect”

The token was issued and no agent has used it yet: step 3 was not run, or the agent is not running. Step 3's last commands say why.

The host's page says “Not connected”, and checks say “Agent: not connected”

The agent was connected and has stopped: the machine is off or asleep, the agent was stopped, or its connection out is blocked. It reconnects by itself once it can. A Mac is watched only while it is awake and its agent is on.

The Mac's menu says “the token was refused”

Its token was replaced, or its host deleted. Choose Enter Token… with a new one from the host's page.

The host's page says the token is in use on more than one machine

Two machines were given the same token, and they keep taking the connection from each other. Each machine needs a host of its own in Gryphon. Replace the token, give the new one to this machine only, and add a host for the other.

A check says “update the agent”

The check is newer than the agent on that machine. Update it; the token and settings are kept.